Studio del traffico con Netflow. Massimo Carboni - Direzione GARR-B Massimo.Carboni@garr.it III WorkShop GARR-B Firenze Gennaio 2001

Dimensione: px

Iniziare la visualizzazioe della pagina:

Download "Studio del traffico con Netflow. Massimo Carboni - Direzione GARR-B Massimo.Carboni@garr.it III WorkShop GARR-B Firenze 24-25 Gennaio 2001"

Silvestro Fantini
8 anni fa
Visualizzazioni

1 Studio del traffico con Netflow - Direzione Massimo.Carboni@garr.it III WorkShop Gennaio 2001

2 2 Indice Network Design e Sicurezza informatica Configurazione Router Analisi dal Router Soluzione software: Cflowd Strumenti di analisi: Arts Tools La configurazione in

3 3 Configurazione del Router RT_NAPOLI# configure terminal RT_NAPOLI(config)#ip flow-export destination RT_NAPOLI(config)#ip flow-export source Loopback0 RT_NAPOLI(config)#ip flow-export version 5 RT_NAPOLI(config)#int atm 1/0/0 RT_NAPOLI(config-if)#ip route-cache flow RT_NAPOLI(config-if)#exit RT_NAPOLI#exit RT_NAPOLI>sh ip flow export Flow export is enabled Exporting flows to (7777) Exporting using source IP address Loopback0 Version 5 flow records, origin-as flows exported in udp datagrams...

RT_NAPOLI(config-if)#ip route-cache flow RT_NAPOLI(config-if)#exit RT_NAPOLI#exit RT_NAPOLI>sh ip flow export Flow export is enabled

4 4 Sh ip cache flow (1/2) RT_NAPOLI>sh ip cache flow IP packet size distribution (60127M total packets): IP Flow Switching Cache, bytes 14 active, inactive, added ager polls, 0 flow alloc failures Active flows timeout in 10 minutes last clearing of statistics 22w2d

004 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.003.003.088.071.395.000.

5 5 Sh ip cache flow (2/2) Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) Flows /Sec /Flow /Pkt /Sec /Flow /Flow TCP-Telnet TCP-FTP TCP-FTPD TCP-WWW TCP-SMTP TCP-X TCP-BGP TCP-NNTP TCP-Frag TCP-other UDP-DNS UDP-NTP UDP-TFTP UDP-Frag UDP-other ICMP IGMP IPINIP GRE IP-other Total:

0 180 403 10.2 33.1 16.9 TCP-BGP 372703 0.0 2 62 0.2 9.4 15.6 TCP-NNTP 6854529 1.5 173 1079 276.9 21.5 15.1 TCP-Frag 55991 0.0 28 165 0.3 15.3 28.0 TCP-other 1004687740 233.9 21 641 5062.1 6.5 16.

6 6 Struttura dei dati (1/2)

7 7 Struttura dei dati (2/2)

8 8 Arts + Cflowd Gira su Linux (RH-6.2) richiede il compilatore GCC-2.95 Arts library (v-0.9.b6) DOC: SOFT: ftp://ftp.caida.org/pub/arts++/arts b6.tar.gz Cflowd DOC: SOFT: ftp://ftp.caida.org/pub/cflowd/cflowd-2-1-b1.tar.gz

org/tools/utilities/arts/ SOFT: ftp://ftp.caida.org/pub/arts++/arts++-0-9-b6.tar.

9 9 Architettura Software: Cflowd Livello di aggregazione cflowdmux + cflowd Flusso UDP dai Router Salvataggio dei dati cflowd cfdcollect Flusso TCP dai differenti processi Analisi dei dati: arts tools

10 10

11 11 Configurazione Cflowd (1/2) #File: /usr/local/arts/etc/cflowd.conf # OPTIONS { LOGFACILITY: local6 TCPCOLLECTPORT: 2056 PKTBUFSIZE: TABLESOCKFILE: /usr/local/arts/etc/cflowdtable.socket FLOWDIR: FLOWFILELEN: NUMFLOWFILES: 10 MINLOGMISSED: 300 /usr/local/arts/data/cflowd/flows } # COLLECTOR { } HOST: ADDRESSES: { } AUTH: none # IP address of central collector

2097152 TABLESOCKFILE: /usr/local/arts/etc/cflowdtable.

12 12 Configurazione Cflowd (2/2) #File: /usr/local/arts/etc/cflowd.conf # CISCOEXPORTER { HOST: # IP address of central collector ADDRESSES: { , # Ethernet , # POS3/ , # ATM4/ , # ATM5/ , # ATM6/ } # FEth8/0 CFDATAPORT: 8001 SNMPCOMM: 'public' LOCALAS: 137 # Local AS of Cisco sending data. COLLECT: { protocol, portmatrix,ifmatrix, nexthop, netmatrix, asmatrix, tos, flows } }

252 # IP address of central collector ADDRESSES: { 193.206.135.4, # Ethernet0 212.1.200.26, # POS3/0 193.206.134.1, # ATM4/0.101 193.206.134.17, # ATM5/0.

13 13 Configurazione Cfdcollect #File: /usr/local/arts/etc/cfdcollect.conf # system { logfacility: local6 # Syslog to local6 facility. datadirectory: /usr/local/arts/data/cflowd fileprefix: arts pidfile: /usr/local/arts/etc/cfdcollect.pid } # cflowd { host: tcpcollectport: 2056 minpollinterval: 600 }

14 14 Configurazione Syslog # Modificare il file: /etc/syslog.conf... local6.*... /var/log/cflowd.log # File: cflowd_start.sh # Esecuzione come utente non privilegiato. /usr/local/arts/sbin/cflowdmux /usr/local/arts/sbin/cflowd /usr/local/arts/sbin/cfdcollect \ /usr/local/arts/etc/cflowdcollect.conf #

sh # Esecuzione come utente non privilegiato.

15 15 Arts Tools set path = ( /usr/local/arts/bin $path) setenv ARTS_ROOT /usr/local/arts setenv ARTS_MILANO_RT /usr/local/arts/data/cflowd/ setenv ARTS_MILANO2_RT /usr/local/arts/data/cflowd/ setenv ARTS_BOLOGNA_RT /usr/local/arts/data/cflowd/ setenv ARTS_ROMA_RT /usr/local/arts/data/cflowd/ setenv ARTS_NAPOLI_RT /usr/local/arts/data/cflowd/ setenv ARTS_MIX /usr/local/arts/data/cflowd/ setenv ARTS_RIX /usr/local/arts/data/cflowd/ setenv MANPATH /usr/local/arts/man:$manpath

254 setenv ARTS_ROMA_RT /usr/local/arts/data/cflowd/193.206.131.254 setenv ARTS_NAPOLI_RT /usr/local/arts/data/cflowd/193.206.130.

16 16 artsprotos # artsprotos -i 30 $ARTS_MILANO2_RT/arts router: ifindex: 30 period: 01/22/ :00:25-01/22/ :10:28 CET Protocol Pkts Pkts/sec Bytes Bits/sec tcp udp icmp ipencap ipv6-crypt ipv

------------- ------------- ------------- ------------- tcp 14401938 23883 13061644575 173288816 udp 469243 778

17 17 artsnets # artsnets -b '01/22/ :00:25' -i 30 $ARTS_MILANO2_RT/arts router: ifindex: 30 period: 01/22/ :00:25-01/22/ :10:28 CET Src Network Dst Network Pkts Bytes / / / / / / / / / / / / / / / / / / / / / /

0/24 269081 381833893 131.225.0.0/16 193.205.157.0/24 141251 204633304 206.204.7.100/32 131.175.0.0/16 96897 137521507 206.204.7.116/32 159.149.0.0/16 91451 137141200 207.189.64.

18 18 artsports # artsportmagg -s i 30 /tmp/ports.mi2ny \ $ARTS_MILANO2_RT/arts # artsports /tmp/ports.mi2ny router: ifindex: 30 period: 01/22/ :50:28-01/23/ :50:30 CET selected ports: Port InPkts InBytes OutPkts OutBytes www ftp-data nntp ssh smtp

------------- www 18419261 1262716424 391344267 365134378963 ftp-data 19647911 11512669526 28531273 34637352684 6699 10263643 7690716540 5941295 6160192545 nntp 7724108 9965403565

19 19 FLOW index: 0xc7ffff router: src IP: dst IP: input ifindex: 101 output ifindex: 116 src port: 80 dst port: 1245 pkts: 9 bytes: 4170 IP nexthop: start time: Mon Jan 22 18:16: end time: Mon Jan 22 18:16: protocol: 6 tos: 0 src AS: 137 dst AS: 137 src masklen: 20 dst masklen: 19 TCP flags: 0x1b engine type: 1 engine id: 4 FlowDump

44.80 dst IP: 212.171.4.180 input ifindex: 101 output ifindex: 116 src port: 80 dst port: 1245 pkts:

20 20 Lettura dei dati #!/usr/bin/perl $flodump= /usr/local/arts/bin/flowdump ; $datadir= /usr/local/arts/data/cflowd/flows/ flows.* ; open (FLOW,"$flowdump $datadir "); while (<FLOW>){ chomp; if ( /FLOW/ ) {$Bytes = 0;$SPort = 0;$SHost = '';} $Bytes = $1 if ( /bytes:\s*(\d*)/ ); $SHost = $1 if ( /src IP: (\d+.\d+.\d+.\d+)/ ); $SPort = $1 if ( /src port:\s+(\d+)$/ ) ; $TotBytes += $Bytes; $Bytes {$SHost} += $Bytes; } foreach $HOST ( sort keys %Bytes ) { printf ("HOST %15s :: Bytes :: %12.1f :: Perc %5.2f%%\n", $HOST,$Bytes{$HOST},$Bytes{$HOST}/$TotBytes*100) if ($Bytes{$HOST}/$TotBytes*100 > 1); } print "Total Bytes: $TotBytes\n";

$* ; open (FLOW,"$flowdump $datadir "); while (<FLOW>){ chomp; if ( /FLOW/ ) {$Bytes = 0;$SPort = 0;$SHost = '';} $Bytes = $1 if ( /bytes:\s*(\d*)/ ); $SHost = $1$

21 21 Implementazione in PoP di Frascati Aggregazione flussi UDP - 5 router di trasporto - 2 router di peering Pentium II 400 Mhz 512 MB/RAM 5Mbps di flusso Direzione Salvataggio dei dati aggregati per analisi off-line Dual Processor PIII 600 Mhz 1GB RAM 60 GB RAID disk 0.5Mbps di flusso UDP>5Mbps TCP ~ 0.5 Mbps

22 22 Carico sui server 2:50pm up 6 days, 4:58, 3 users, load average: 1.41, 0.96, processes: 36 sleeping, 5 running, 0 zombie, 1 stopped CPU states: 43.5% user, 24.6% system, 0.0% nice, 31.7% idle Mem: K av, K used, 1896K free, 28084K shrd, 27772K buff Swap: K av, 7160K used, K free 33288K cached PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND 5687 carboni M 223M R :28 cflowd 5768 carboni M 210M 420 R :08 cflowd 5676 carboni R :59 cflowdmux 2:52pm up 42 days, 2:27, 5 users, load average: 0.11, 0.06, processes: 44 sleeping, 1 running, 0 zombie, 0 stopped CPU states: 0.0% user, 0.6% system, 0.0% nice, 99.3% idle Mem: K av, K used, 33456K free, 10600K shrd, K buff Swap: K av, 3612K used, K free K cached PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND 6657 carboni M 960 S :10 cfdcollect

23 23

24 24 Alcuni puntatori ftp://ftp-eng.cisco.com/ftp/drowell/flow_agg.pdf ftp://ftp.caida.org/pub/arts++/arts b6.tar.gz ftp://ftp.caida.org/pub/cflowd/cflowd-2-1-b1.tar.gz

25 25 That s all folks

Documenti analoghi

Problemi Una descrizione dei problemi sorti durante le fasi di

Problemi Una descrizione dei problemi sorti durante le fasi di Etichetta del test case Composta da: - DUT : Device Under Test; - Numero/i incrementale/i: per identificare la gerarchia di appartenenza; - Tipologia: TP (throughput), LT (latenza), FL (Frame Loss); -